Disable email signatures in Outlook for Windows using Intune

Overview

After you implement Opensense signature management, some users may still have signatures applied in Microsoft Outlook. To stop this, disable the native email signature experience in Outlook for Windows through Intune. There are two ways:

• With a configuration profile
• With a PowerShell script that runs on users’ machines

Before you start

• Microsoft Endpoint Manager (Intune)
• Devices that are Azure AD-joined, with users signed in with their Azure AD account

Disabling signatures with a configuration profile

1. Sign in to the Microsoft Endpoint Manager admin center.
2. Go to Devices > Configuration profiles, and click Create profile.
3. In Platform, select Windows 10 and later. In Profile type, select Templates. Under Template name, select Administrative Templates, and click Create.
4. In the Basics step, enter a profile name (required) and a description. Click Next.
5. Select User Configuration in the menu on the left, and type Do not allow signatures in the search box.
6. Click the setting name, Do not allow signatures for e-mail messages, to open its pane. Select Enabled, then click OK and Next.
7. If you use scope tags, set them. Click Next.
8. In the Assignments step, choose the users for whom signatures are disabled:
   • To disable signatures for everyone in your organization, click Add all users.
   • To disable signatures for some Azure Active Directory groups, click Add groups.
   • To let some Azure AD groups keep the native signature experience in Outlook for Windows, click Add groups under Excluded groups.
9. In the Review + create step, check your settings, and click Create to save and apply the policy.

From then on, the native signature experience in Outlook for Windows is disabled on the machines of the users you chose.

Create profile · Devices > Configuration profiles

Choose the template · Administrative Templates

Basics · Name and description

Find the setting · User Configuration

Enable the setting · Then OK and Next

Assignments · All users, or selected groups

Review + create · Check the settings, then Create

Tracking the profile

To track the assignment of the profile, go to Devices > Configuration profiles and click the profile name. The Overview page shows for how many devices and users the profile was assigned successfully or unsuccessfully. For details on devices, users, or settings, click Device status, User status, or Per-setting status.

Disabling signatures with a PowerShell script

To disable the native signature experience with a PowerShell script that Intune runs, prepare the script file, then set up Intune to run it.

Preparing the script file

1. Open a text editor, such as Notepad, or the PowerShell ISE app, and paste in this code:

   New-ItemProperty -path
   "HKCU:\SOFTWARE\Microsoft\Office\16.0\Common\MailSettings" -Name
   "DisableSignatures" -Value '1' -PropertyType 'DWORD' -Force

2. Use Save As (Ctrl+Shift+S) to save the file in the .ps1 format, for example Disable_signatures.ps1.

Setting up Intune to run the script

1. Sign in to the Microsoft Endpoint Manager admin center.

2. Go to Devices > Scripts, click Add, and select Windows 10 and later.

3. Name the script, add an optional description, and click Next.

4. In the Script settings step, load the script file you prepared into Script location, and set these options:

   • Run this script using the logged-on credentials: Yes. The script then runs for each user who signs in on a machine and disables signatures for their account.
   • Enforce script signature check: No.
   • Run script in 64 bit PowerShell Host: Yes. If users’ machines are 32-bit, select No.

   Click Next.

5. If you use scope tags, set them for this script policy. Click Next.

6. In the Assignments step, choose the users the script runs for: all users, or specific Azure AD user groups. To exclude Azure AD groups, use the Excluded groups section.

7. In the Review + add step, check the settings for the script policy, and click Add. The script is added to the scripts list.

Assign the script to users, not devices

The script changes an entry in the Current User registry key. If more than one person uses the same machine, the script must run for each user who signs in on it.

Add a script · Devices > Scripts > Add

Basics · Name and description

Script settings · Yes, No, Yes

Assignments · Users, not devices

Review + add · Then Add

Tracking the script

To track the script runs, go to Devices > Scripts and click the script name. The Overview page shows for how many devices and users the script ran successfully or unsuccessfully. For details, such as device names and user names, click Device status or User status.

What’s next

• Disable existing Microsoft Outlook signatures using a Group Policy (GPO): disable Outlook signatures with Group Policy instead.
• How does Opensense work with Microsoft 365?: how Opensense applies signatures in Microsoft 365.